Data Management

Question 2

What is the Data Protection Act 2018?

Answer 2

• UK’s implementation of the General Data Protection Regulation 2016 (GDPR)
• Complete data protect system – as well as governing personal data covered by GDPR, it covers all other general data as previously covered by the 1998 Act

Question 3

What is GDPR?

Answer 3

• General data protection regulation
• Relates to personal data
• Aims to create a single data protection regime for anyone doing business in the EU and to empower individuals to take control of how their data is used by third parties
• Gives people stronger rights to be informed about how their personal information is used

Question 4

When did GDPR come into force?

Answer 4

25th May 2018

Question 5

What are the key requirements under GDPR?

Answer 5

• Obligation to conduction data protection impact assessments for high risk holding of data
• New rights for individuals to have access to information on what personal data is held and to have it erased
• A data controller decides how and why personal data is processed and is directly responsible for GDPR
• ‘Data accountability’ ensuring that organisations can prove to the Information Commissioners Office (ICO) how they comply with the new regulations

Question 6

What happens if you breach GDPR? What is the penalty?

Answer 6

• Data security breaches need to be reported to Information Commissioners Office (ICO) within 72 hours where there is a loss of personal data and a risk of harm to individuals
• An increase in fines up to 4% global turnover of the company or €20m (whichever is the greater)
• Policed by the ICO

Question 7

What are the 8 individual Rights under GDPR?

Answer 7

AIRER POA:

1. Right of access
2. Right to be informed
3. Right to rectification
4. Right to erasure
5. Right to restrict processing
6. Right to data portability (to use for their own purposes)
7. Right to object
8. Rights to automated decision making and profiling (as undertaken by insurance companies

Question 8

How has your firm changed their data management practices to comply with GDPR?

Answer 8

• Conducted data protection impact assessments i.e. evaluated risks associated with holding information about individuals
• Ensure data accountability through the appointment of a named data controller
• Contacted individuals who were on distribution lists to confirm that they wanted to be contacted
• Trained staff
• Ensured correct firewalls were in place to ensure appropriate security of personal data

Question 9

Under GDPR, would you be able to transfer personal data you hold outside of the UK?

Answer 9

GDPR restricts transfers of personal data outside the European Economic Area (EEA), unless the rights of the individuals personal data is protected in another way

Question 10

What is the Freedom of Information Act 2000?

Answer 10

Gives individuals the right of access to information held by public bodies

Question 11

What does the Freedom of Information Act 2000 require of public bodies?

Answer 11

• Public body must tell any individual requesting sight of information whether it holds it
• Normally the public body is required to supply it in 20 working days in the format requested
• It can charge for the provision of the information

Question 12

What are the exemptions from the Freedom of Information Act 2000?

Answer 12

• Contrary to the GDPR requirements
• It would prejudice a criminal matter under investigation
• It would prejudice a person’s/organisation’s commercial interest

Question 13

What are the elements of a Non-Disclosure Agreement (NDA)?

Answer 13

• Identification of the parties
• Definition of what is deemed to be confidential
• Scope of the confidentiality obligation by the receiving party
• The exclusions from confidential treatment
• The length of term of the agreement

Question 14

What are automated valuation models (AVMs)?

Answer 14

• Software systems which can provide property valuations using mathematical modelling combined with a database
• They are most used for residential property

Question 15

What does copyright mean?

Answer 15

• A set of exclusive rights granted to the author or creator of any original work, including the right to copy
• These rights can be licensed, assigned or transferred
• Form of intellectual property

Question 16

What is a deed?

Answer 16

A legal document made under seal

Question 17

How can you prove ownership of land which is not registered with the Land Registry?

Answer 17

The Deeds will set out information about the ownership and details of a property

Question 18

What professional statement is the RICS planning on releasing relating to the encryption of data and use of cloud-based storage facilities?

Answer 18

Data Handling and Prevention of Cybercrime, 2020

Question 19

What will be contained in the professional statement on Data Handling and Prevention of Cybercrime , 2020?

Answer 19

• Best practice and 24 mandatory obligations
• Advise on matters such as encryption to protect data on portable devices, best practice when using cloud-based storage facilities (e.g. Dropbox, OneDrive and Google Drive) and ensure appropriate data handling policies are in place in the event of a data breach or malware attack
• It will sit behind the legal requirements of the Data Protection Act 2018 in the UK